dissect.target.plugins.os.windows.services
#
Module Contents#
Classes#
Services plugin. |
Attributes#
- dissect.target.plugins.os.windows.services.ServiceRecord#
- dissect.target.plugins.os.windows.services.SERVICE_ENUMS#
- dissect.target.plugins.os.windows.services.RE_PATH_SPLIT#
- dissect.target.plugins.os.windows.services.RE_PATH_SPLIT_FALLBACK#
- class dissect.target.plugins.os.windows.services.ServicesPlugin(target: dissect.target.Target)#
Bases:
dissect.target.plugin.Plugin
Services plugin.
- KEY = 'HKLM\\SYSTEM\\CurrentControlSet\\Services'#
- check_compatible()#
Perform a compatibility check with the target.
This function should return
None
if the plugin is compatible with the current target (self.target
). For example, check if a certain file exists. Otherwise it should raise anUnsupportedPluginError
.- Raises:
UnsupportedPluginError – If the plugin could not be loaded.
- services()#
Return information about all installed services.
The HKLMSYSTEMCurrentControlSetServices registry key contains information about the installed services and drivers on the system.
- Sources:
- Yields ServiceRecords with fields:
hostname (string): The target hostname. domain (string): The target domain. ts (datatime): The last modified timestamp of the registry key. name (string): The service name. displayname (string): The service display name. servicedll (uri): The service dll. imagepath (uri): The service image path. objectname (string): The object under which the service runs (for example LocalSystem) start (string): The service start field. type (string): The service type field. errorcontrol (string): The service error control field.